I misunderstood how the "no-cache" attribute is supposed to work.
According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.1 the browser CAN store responses marked as "no-cache", however the browser MUST revalidate the response. Without the attribute, then the entry can be re-used without revalidation provided that it has not expired. The "no-store" attribute is the one that is intended to prevent storage of the response in cache.
